Read the docs
TI-2022-22719 Aliases CVE-2022-45935GHSA-v6vp-62vc-84qw

Apache James server: Temporary File Information Disclosure

Priority LOW 25CWE-668Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-668 and the CVSS impact.

Summary

Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user data in transit. Vulnerable components includes the SMTP stack and IMAP APPEND command. This issue affects Apache James server version 3.7.2 and prior versions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0037 31st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache James serverup to 3.7.2—No fix listedCNA
—org.apache.james:james-server (Maven)up to 3.7.2—No fix listedGHSA-v6vp-62vc-84qw
  • Apache James server VendorApache Affected up to 3.7.2 Fixed in — No fix listed CNA
  • org.apache.james:james-server (Maven) Vendor— Affected up to 3.7.2 Fixed in — No fix listed GHSA-v6vp-62vc-84qw

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:james:*:*:*:*:*:*:*:*up to 3.7.2VulnerableApache
  • cpe:2.3:a:apache:james:*:*:*:*:*:*:*:* Versions up to 3.7.2 Vulnerable ·Apache

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 18 products
  • Red Hat Data Grid 8
  • Red Hat Decision Manager 7
  • Red Hat Fuse 7
  • Red Hat Integration Camel K 1
  • Red Hat Integration Camel Quarkus 1
  • Red Hat JBoss Data Grid 7
  • Red Hat JBoss Data Virtualization 6
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat JBoss Fuse 6
  • Red Hat JBoss Fuse Service Works 6
  • Red Hat OpenShift Application Runtimes
  • Red Hat Process Automation 7
  • Red Hat Satellite 6
  • Red Hat Single Sign-On 7
  • Red Hat build of Apache Camel for Spring Boot 3
  • Red Hat build of Apicurio Registry 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-45935
  2. 2026-10-03 Alias added: GHSA-v6vp-62vc-84qw

References

Advisory 2

Other 2

  • TI-2019-00201 XML external entity injection in Apache PDFBox CVSS 3.1CRITICAL 9.8
  • TI-2023-28170 Apache James server: Privilege escalation via JMX pre-authentication deserialisation CVSS 3.1CRITICAL 9.8
  • TI-2021-17565 Sieve file storage vulnerable to path traversal attacks CVSS 3.1CRITICAL 9.1
  • TI-2006-02714 The SMTP server in Apache Java Mail Enterprise Server (aka Apache James) 2.2.0 allows… CVSS 2.0HIGH 7.8
  • TI-2021-17305 Apache James IMAP vulnerable to a ReDoS CVSS 3.1HIGH 7.5
  • TI-2023-11431 Apache James server: Privilege escalation through unauthenticated JMX CVSS 3.1HIGH 7.8
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences